Sensitive data exposure in browser local storage or session storage in plaintext.
The scanner models these as two separate data sinks, Local Storage (localStorage.setItem) and Session Storage
(sessionStorage.setItem), with identical risk profiles. Everything on this page applies to both.
Impacted Frameworks and Reasons
Section titled “Impacted Frameworks and Reasons”GDPR (Articles 5 and 32)
Section titled “GDPR (Articles 5 and 32)”-
Article 5 requires data minimization, purpose limitation, and integrity. Storing personal data in local storage in plaintext increases the risk of unauthorized access and violates these principles.
-
Article 32 requires appropriate technical and organizational security measures. Local storage provides limited control and increases exposure risk.
CCPA and CPRA
Section titled “CCPA and CPRA”-
Requires transparency and protection of personal data.
-
If personal data is stored in local storage, it can be accessed by browser extensions, scripts, or third party libraries, resulting in undisclosed sharing or unauthorized access.
-
PHI must be protected with adequate safeguards.
-
Storing PHI in local storage exposes it to any script running in the browser environment, which is considered insufficient protection and may be treated as an unauthorized disclosure.
-
Cardholder data must never be stored unencrypted or outside a controlled environment.
-
Local storage is not a secure environment and plaintext storage of cardholder data violates PCI protection and encryption requirements.
-
Financial institutions must safeguard customer financial information.
-
Storage in local storage demonstrates insufficient technical controls.
PIPEDA
Section titled “PIPEDA”-
Requires secure handling and informed consent for personal data.
-
Storing sensitive data in local storage prevents demonstrating strong protection and increases the likelihood of unauthorized access.
-
Requires purpose limitation and confidentiality of personal data.
-
Local storage increases exposure risk and reduces confidentiality protections.
NIST 800 53
Section titled “NIST 800 53”-
Emphasizes controlled access, encryption at rest, and protection of sensitive information.
-
Local storage does not provide strong access controls and makes data easily accessible to scripts or malicious actors.
ISO IEC 29100
Section titled “ISO IEC 29100”-
Requires accountability, transparency, and suitable safeguards.
-
Storing sensitive data in local storage provides insufficient protection and weakens assurance.
KSA PDPL
Section titled “KSA PDPL”-
Requires lawful processing and safeguards to prevent unauthorized disclosure.
-
Local storage increases the likelihood of unintentional disclosure.
UAE PDPL
Section titled “UAE PDPL”-
Processing must remain protected and aligned with the stated purpose.
-
Plaintext in local storage creates misalignment between required protection and actual handling.
Qatar PDPPL
Section titled “Qatar PDPPL”-
Requires strong safeguards to prevent unauthorized access.
-
Local storage provides limited control and increases exposure risk.
CWE and OWASP
Section titled “CWE and OWASP”Both sinks map to CWE-312: Cleartext Storage of Sensitive Information and OWASP Top 10
A04:2021 – Insecure Design.
Recommended Remediation
Section titled “Recommended Remediation”Avoid storing sensitive data in local storage. Audit and refactor frontend code to remove unnecessary handling of sensitive data in browser accessible storage.